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Claims / 

1 A method for preventing undesilble activities of Executable Objects 
vU an application, comprising dinying to the same application, or one 
or more of its threads, access to/a secured resource if it has previously 
exhibited Internet behavior ar/d has not met a specific condition for 
accessing said resource, and denying said appUcation, or one or more of 
its threads, Internet behavior if, at the time access is sought, it is 
accessing a secured resource ./ 

2 A method according to chL 1, comprising recording in a memory 
events representative of /internet behavior, keeping a record of all 
purees that are to be l/ept secured and when an appUcation that has 
previously exhibited In/ernet behavior attempts to access one such 
secured resource, denyh/g access to said secured resource, unless: 

a) At least a predetermined period of time has passed since the last 

Internet behavior; or 

b) It has perfoxmid at least a predetermined number of operations 

after exhibitir/g Internet behavior; or 

c) Another presi condition has been fulfilled. 

3 A method accordJto claim 2, wherein the preset condition comprises 

' the exercise of coLol over the execution of downloadables received 
during Internet bihavior, to ensure that no unexecuted downloadable 
may access the sefeured resource. 

4 A method accoring to claim 2, wherein the preset condition comprises 
the analysis of fe downloadables to ascertain that there are harmless. 
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5. A method according to ax* one of claims 1 to 4, wherein Internet 
behavior is blocked by disabling the network connection creation. 

6. A method according to jLy one of claims 1 to 4, wherein Internet 
behavior is blocked by disabling specific protocols. 

7. A method according to Lim 6, wherein the specific protocols comprise 
HTTP FTP, SMTP, or /the like communication protocol. 

8. A method according/to any one of claims 1 to 4, wherein Internet 
behavior is blocked by disabling the transfer of EOs in the 
communication protocols. 

97A^^^^ 5 to 8 > wterein ~ t&e access to 

trusted sites is noft disabled. 

10. A method acco/ding to any one of claims 1 to 4, wherein access to a 
secured resource is blocked by disabling a thread using a specific 
system serviceihat is used to access the secured resource. 

11. A method Lording to any one of claims 1 to 10, wherein all 
sub-threads Af a thread that is denied access to a secured resource are 
also denied Access to secured resources. 

12. A methol according to any one of claims 1 to 10, wherein all 
sub-threals of a thread that is denied Internet behavior are also denied 
Internet behavior. 
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13 Apparatus for preventing undesirable activities of Executable Objects 
via an application, comprising a memory for storing a record oflntemet 
behavior of a pluraJil of applications, and means for denymg to the 
same application accL to a secured resource if it has previously 
exhibited Internet heavier and has not met a specific condition for 



accessing said resoura 



: preventing 



14. Apparatus for 
via an application, 
behavior of a plurality 
application, or one 
time access is sought , 



Co: apnsing a 



undesirable activities of Executable Objects 

^ a memory for storing a record of Internet 

of applications, and means for denying said 
more of its threads, Internet behavior if; at the 
it is accessing a secured resource. 



15 A system for preventing undesirable activities of Executable Objects 
via an application^ comprising a computer on which one or more 
applications are tolun, said computer being connectable to the Internet 
or Intranet or Extf anet, said computer being provided with a memory 

for storing a recof * °* "<* ° f "* ° f 

applications, andLans for denying to the same application access to a 
secured resourced it has previously exhibited Internet behave and 
has not met a specific condition for accessing said resource. 

16 A system for preventing undesirable activities of Executable Objects 
via an application, comprising a computer on which one or more 
applications aj to run, said computer being connectable to the Internet 
or Intranet or/Extranet, said computer being provided with a memory 
for storing a record of Internet behavior of each of said plurality of 
applications, U means for denying said application, or one or more of 
its threads, fntemet behavior if, at the time Internet behavior » 
exhibited, it ik accessing a secured resource. 
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17. A method for preventing undesirable activities of Executable Objects 

via an application, substanti/llyb4de€cribed and illustrated. 



